From c9cf025fadfe043f0f2f679e10d1207d8a158bb6 Mon Sep 17 00:00:00 2001
From: Daniel Baumann <daniel.baumann@progress-linux.org>
Date: Sun, 7 Apr 2024 17:01:31 +0200
Subject: Adding debian version 2.4.57-2.

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>
---
 debian/perl-framework/t/security/CVE-2009-3555.t | 67 ++++++++++++++++++++++++
 1 file changed, 67 insertions(+)
 create mode 100644 debian/perl-framework/t/security/CVE-2009-3555.t

(limited to 'debian/perl-framework/t/security/CVE-2009-3555.t')

diff --git a/debian/perl-framework/t/security/CVE-2009-3555.t b/debian/perl-framework/t/security/CVE-2009-3555.t
new file mode 100644
index 0000000..bd0c413
--- /dev/null
+++ b/debian/perl-framework/t/security/CVE-2009-3555.t
@@ -0,0 +1,67 @@
+use strict;
+use warnings FATAL => 'all';
+
+use Apache::Test;
+use Apache::TestRequest;
+use Apache::TestUtil;
+
+plan tests => 4, need 'ssl';
+
+# This test case attempts only one type of attack which is possible
+# due to the TLS renegotiation vulnerability, CVE-2009-3555.  A
+# specific defense against this attack was added to mod_ssl in
+# r891282.  For more information, see the dev@httpd thread beginning
+# at message ID <4B01BD20.1060300@adnovum.ch>.
+
+Apache::TestRequest::set_client_cert("client_ok");
+
+Apache::TestRequest::module('mod_ssl');
+
+my $sock = Apache::TestRequest::vhost_socket('mod_ssl');
+
+if ($sock && $sock->connected && $sock->get_sslversion() eq "TLSv1_3") {
+    skip "Skipping test for TLSv1.3" foreach(1..4);
+    exit;
+}
+
+ok $sock && $sock->connected;
+
+
+my $req = "GET /require/asf/ HTTP/1.1\r\n".
+   "Host: " . Apache::TestRequest::hostport() . "\r\n".
+    "\r\n".
+    "GET /this/is/a/prefix/injection/attack HTTP/1.0\r\n".
+    "Host: " . Apache::TestRequest::hostport() . "\r\n".
+    "\r\n";
+
+ok $sock->print($req);
+
+my $line = Apache::TestRequest::getline($sock) || '';
+
+ok t_cmp($line, qr{^HTTP/1\.. 200}, "read first response-line");
+
+my $rv = 0;
+
+do {
+    $line = Apache::TestRequest::getline($sock) || '';
+    $line = super_chomp($line);
+    print "# line: $line\n";
+    if ($line eq "Connection: close") {
+        $rv = 1;
+    }
+} until ($line eq "");
+
+ok $rv, 1, "expected Connection: close header in response";
+
+sub super_chomp {
+    my ($body) = shift;
+
+    ## super chomp - all leading and trailing \n (and \r for win32)
+    $body =~ s/^[\n\r]*//;
+    $body =~ s/[\n\r]*$//;
+    ## and all the rest change to spaces
+    $body =~ s/\n/ /g;
+    $body =~ s/\r//g; #rip out all remaining \r's
+
+    $body;
+}
-- 
cgit v1.2.3